Example for Configuring WIDS/WIPS
Service Requirements
Due to openness of the WLAN, there are security risks. If attackers deploy an AP with the SSID huawei on the network to forge an authorized AP, STAs may associate with the rogue AP. If wireless terminals attack the WLAN network, for example, the terminals try to crack the WAP2-PSK key or initiate flood attacks to the authorized AP, there are security risks on the network. WIDS and WIPS need to be configured on the AP to detect attacks of rogue APs and terminals.
Networking Requirements
- DHCP deployment mode: The AP functions as a DHCP server to assign IP addresses to STAs.
Data Preparation
Item |
Data |
|---|---|
Radio 0 |
|
WIDS and WIPS parameters |
|
Dynamic blacklist aging time |
200 seconds |
Configuration Roadmap
- Configure wireless services on the AP. For details, see Example for Configuring Fat AP Layer 2 Networking.
- Configure WIDS and WIPS to detect and contain rogue APs and prevent STAs from associating with the rogue APs. Add attacking devices to the dynamic blacklist so that the APs discard packets from the attacking devices.
- Verify the configuration.
In this example, the authorized APs work in normal mode and have the detection function enabled. In addition to transmitting WLAN service data, AP radios need to perform the monitoring function. A transient increase in the WLAN service latency may occur, which does not affect network access. However, if any latency-sensitive service (such as videoconferencing) is running, it is recommended that a separate radio be used for air scan.
The following example configures WIDS and WIPS on radio 0. The configuration on radio 1 is similar.
Procedure
- Enable WIDS and WIPS.
- Enable device detection, rogue device containment, flood attack detection, and WPA2-PSK attack detection.
- Enable device detection, rogue device containment, flood attack detection, and WPA2-PSK attack detection.
- Set parameters related to WIDS and WIPS.
- Set the rogue device containment mode and parameters for detection of brute force key cracking attacks and flood attacks, and enable the dynamic blacklist function.
- Set the rogue device containment mode and parameters for detection of brute force key cracking attacks and flood attacks, and enable the dynamic blacklist function.
- Set the aging time of the dynamic blacklist.
- Choose .
- Set Dynamic blacklist aging time to 200 seconds.
- Click Apply. In the Info dialog box that is displayed, click OK.
- Verify the configuration.
- Choose .
- Check information about detected rogue devices on the Rogue Device tab page.
- Check statistics on all detected attacks on the Attack Statistics tab page.
- Check detailed information about attacks on the Attack Records tab page.
- Check information about attack devices in the blacklist on the Dynamic Blacklist tab page.
